3.2. Authentication Capabilities of Microsoft Entra ID

💡 First Principle: Authentication capabilities in Entra ID exist to make the "prove who you are" step both stronger (harder for an attacker to fake) and less painful (fewer passwords to remember and reset) at the same time — a goal that sounds contradictory until you realize modern methods like passwordless authentication achieve both simultaneously.

This matters because password-only authentication is both weak (phishable, reusable, guessable) and annoying (forgotten, expired, locked out) — the worst combination for security and user experience alike. Entra ID's authentication capabilities systematically replace or reinforce the password with stronger, often more convenient, alternatives.

⚠️ Common Misconception: Believing MFA equals "a text message with a code." Modern authentication methods go well beyond SMS, and Microsoft actively steers organizations away from SMS/voice toward stronger methods — covered in the next two subsections.